codeql.yml

name: CodeQL

"on":
  push:
    branches:
      - master
  pull_request:
    branches:
      - master
  schedule:
    # At 01:30 AM on Sunday
    - cron: "30 1 * * 0"

permissions:
  contents: read

jobs:
  CodeQL-Analysis:
    runs-on: ubuntu-latest

    permissions:
      # required for all workflows:
      security-events: write
      # required for workflows in private repositories:
      actions: read
      contents: read

    steps:
      - name: check out the codebase
        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3

      - name: set up python in minimum required version
        uses: actions/setup-python@57ded4d7d5e986d7296eab16560982c6dd7c923b # v4
        with:
          python-version: "3.7"

      - name: install dependencies
        run: |
          python -m pip install -r requirements-dev.txt
          python -m pip install -r requirements.txt
          echo "CODEQL_PYTHON=$(which python)" >> $GITHUB_ENV

      - name: Initialize CodeQL.
        uses: github/codeql-action/init@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2
        with:
          languages: python
          # https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#analyzing-python-dependencies
          setup-python-dependencies: false

      # Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
      # If this step fails, then you should remove it and run the build manually.
      - name: Autobuild
        uses: github/codeql-action/autobuild@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2

      - name: Perform CodeQL Analysis.
        uses: github/codeql-action/analyze@00e563ead9f72a8461b24876bee2d0c2e8bd2ee8 # v2